California residents can use new tool to demand brokers delete their personal data | TechCrunch

"California is giving residents a new tool that should make it easier for them to limit data brokers' ability to store and sell their personal information. While state residents have had the right to demand that a company stop collecting and selling their data since 2020, doing so required a laborious process of opting out with each individual company. The Delete Act, passed in 2023, was supposed to simplify things, allowing residents to make a single request that more than 500 registered data brokers delete their information."

"Now the Delete Requests and Opt-Out Platform (DROP) actually gives residents the ability to make that request. Once DROP users verify that they are California residents, they can submit a deletion request that will go to all current and future data brokers registered with the state. But that doesn't necessarily mean that all your data will be deleted immediately. Brokers are supposed to start processing requests in August 2026, then they have 90 days to actually process requests and report back. If they don't delete your data, you'll have the option to submit additional information that may help them locate your records."

"Companies will also be able to keep first-party data that they've collected from users. It's only brokers who seek to buy or sell that data - which can include your social security number, browsing history, email address, phone number, and more - who will be required to delete it. Some information, such vehicle registration and voter records, is exempt from deletion because it comes from public documents. Other information, such as sensitive medical information, may be covered under other laws like HIPAA."

California's Delete Act of 2023 enables a single deletion request to registered data brokers. The Delete Requests and Opt-Out Platform (DROP) allows verified California residents to submit one request that goes to current and future registered brokers. Brokers must begin processing requests in August 2026 and have 90 days to act and report; residents can submit additional information if deletions are not completed. Companies may retain first‑party data they collected directly, while brokers who buy or sell brokered data must delete it. Certain public records like vehicle registration and voter rolls are exempt; sensitive medical data may fall under HIPAA. The California Privacy Protection Agency says the tool could reduce unwanted contacts and lower risks of identity theft, fraud, AI impersonation, and data leaks.

Read at TechCrunch